User Rights Problem

Please help me in user rights assignments as I want to restrict the rights of users as per their roles.
I am using local users and groups on the windows 2000 server to work with cognos. I have created three groups namely BIAdministrator, BIProfessional and BIConsumer in the local server and create users as follows:
The following is the hierarchy of the users:
BIAdministrator:
----------------
Administrator --- (local administrator account which is also member of BIAdministrator group in local groups on server
CognosAdmin --- (Account created in local server and member of BIAdministrator group in local groups on server
BIProfessional:
---------------
mfielbig --- (Account created in local server and member of BIProfessional group in local groups on server
BIConsumer:
-----------
danyal --- (Account created in local server and member of BIConsumer group in local groups on server
Under Cognos Configuration the following is the details:
=============================================
Environment --> Gateway namespace --> blank
Environment --> Allow namespace override? --> False
Security --> Authentication --> Restrict access to members of the built-in namespace? ---> True
Security --> Authentication --> Cognos --> Allow anonymous access? --> False
Security --> Authentication --> ZBIntelligence --> Type --> NTLM
Security --> Authentication --> ZBIntelligence --> Namespace ID --> ZBIntelligence
Security --> Authentication --> ZBIntelligence --> NTLM domain name --> Blank
Security --> Authentication --> ZBIntelligence --> Primary domain controller name --> Blank
Security --> Authentication --> ZBIntelligence --> Advance properties --> singleSignonOption
Advance properties --> singleSignonOption (Name =singleSignonOption and Value = IdentityMapping)
I have removed everyone from all the groups and roles of cognos connection. I have assigned directory administrator from cognos namespace to BIAdministrator group, consumer to BIConsumer group and analysis user to BIProfessional Group.
The problem is that there is no difference in logon using administrator, CognosAdmin, mfielbig or Danyal. Every one has full rights to tool-> directory and all sub-details and rights as if they are directory administrators. Every user have same rights on reports, packages etc. I have eliminated the rights one by one but all in vain no difference.
Please help me I am desperately stuck up as I have completed data warehousing and framework modeling and now my users can use the model but I can not give them access under administrator right.